CVE-2026-27785 identifies a vulnerability in specific firmware versions of the Milesight MS-Cxx63-PD AIOT camera where hard-coded credentials are present. Hard-coded credentials (CWE-798) can allow unauthorized access if discovered by an attacker. The CVSS 4.0 vector indicates the attack vector is adjacent network (AV:A), low attack complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), and high impact on confidentiality, integrity, and availability (VC:H/VI:H/VA:H). No patch or official remediation guidance has been provided yet.

The presence of hard-coded credentials in the affected Milesight camera firmware could allow an attacker with network access adjacent to the device to gain unauthorized access without needing privileges or user interaction. This can lead to full compromise of confidentiality, integrity, and availability of the device. However, no known exploits have been reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider limiting network exposure of affected devices and monitor for any updates from Milesight regarding patches or mitigations. No vendor advisory or official fix is currently available.